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REMARKS 

The following remarks are made in response to the Final Office Action mailed June 
30, 2005. Claims 1-47 were rejected. Claims 1-47 remain pending in the application and are 
presented for reconsideration and allowance. 

Claim Rejections under 35 U.S.C. § 103 

Claims 1, 2, 37, 38, and 45 are rejected under 35 U.S.C. §103(a) as being 
unpatentable over Porras et al., U.S. Patent No. 6,321,338 ("Porras") in view of Fishman et 
al., U.S. Patent Application Publication 2001/0037321 ("Fishman"). 

Applicant submits that Porras and Fishman, either alone, or in combination, fail to 
teach or suggest the invention of independent claims 1, 37, and 45. Independent claim 1 
recites a method for analyzing a stream of network usage data. The method includes 
updating a statistical model using the most recent record event by adding the most recent 
record event to the statistical model, wherein an identifier is associated with each record 
event, including updating only a portion of the statistical model associated with the identifier. 

Independent claim 37 recites a network usage analysis system for analyzing a stream 
of network usage data. The network usage analysis system includes a data analysis system 
server which upon receiving a most recent record event, the data analysis system server 
updates the statistical model using the most recent record event by adding the most recent 
record event to the statistical model, wherein an identifier is associated with each record 
event, including updating only a portion of the statistical model associated with the identifier. 

Independent claim 45 recites a computer readable medium having computer 
executable instructions for performing a method for analyzing a stream of network usage 
data. The method includes updating the statistical model using the most recent record event 
by adding the most recent record event to the statistical model, wherein an identifier is 
associated with each record event, including updating only a portion of the statistical model 
associated with the identifier. 

Porras discloses a method of network surveillance including building at least one 
long-term and at least one short-term statistical profile of network packets that monitor data 
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transfers, errors, or network connections. The long-term profile is compared to the short-term 
profile to determine whether suspicious network activity exists. (Col. 1, lines 44-54). 

Fishman recites a method of building predictive models based on transactional data. 
In the system of Fishman, sets of aggregation models are utilized, wherein each transactional 
source of data is processed by a dedicated aggregation module. When a new transactional 
record becomes available the output of the model is updated by processing the new records 
only associated with a dedicated aggregation module. The output of each aggregation 
module is an array of scalar numbers that can be used as an input to a traditional modeling 
module. (Paragraph 8). 

The Examiner admits that Porras fails to disclose updating only a portion of the 
statistical model associated with the identifier. The Examiner submits that this limitation is 
taught by Fishman. (Office Action, page 5). 

Fishman does not teach or suggest updating only a portion of the statistical model 
associated with the identifier. In contrast, Fishman discloses updating the aggregation 
module outputs with each new transactional record. All aggregation module outputs 
combined with the traditional array of scalar inputs 26 are used as input attributes for the 
traditional modeling module 20 that implements logistic regression, neural networks, or 
radial basis functions technology. (See Fishman, paragraph 24). Accumulated values of fk 1 
are combined with the traditional array of scalar inputs S 322 and are used as input attributes 
for the traditional modeling module 324. Output of the model is calculated in the traditional 
modeling module 328. (Paragraphs 31 and 32). The new transactional record is processed 
412 and outputs of the corresponding aggregation module is updated 414. New values of f^ 1 
are combined with the traditional array of scalar inputs S 416 and are used as input attributes 
for the traditional modeling module 418. These values may be stored again 420 for further 
model output updates. Output of the model is calculated in the traditional modeling module 
422. (Paragraphs 39-41). 

Therefore, Fishman discloses updating the outputs of the aggregation module that 
provide the traditional array of scalar inputs to the traditional modeling module. In Fishman, 
the statistical model is not partially updated, but rather the entire statistical model is 
updated/recalculated based on a new set of scalar inputs provided by the aggregation module. 
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Further, there is no teaching or suggestion to combine Porras and Fishman. There is 
no teaching in Porras or Fishman to combine the method of building predictive models on 
transactional data of Fishman with the network surveillance system of Porras. 

In view of the above, Porras and Fishman, either alone, in combination, fail to teach 
or suggest the invention of independent claims 1, 37, and 45. Accordingly, withdrawal of the 
rejection of claims 1, 37, and 45 under 35 U.S.C. § 103(a) is respectfully requested. 

Claim 2 recites updating the statistical model further comprises removing a least 
recent record event from the statistical model. Claim 38 recites wherein the data 
analysis system server removes the least recent record event from the statistical model. 
The Examiner submits that Porras explicitly shows these limitations in column 6, lines 47-50, 
which state that at update time (typically, a time of low system activity), the update function 
folds the short-term values observed since the last update into the long-term profile, and the 
short-term profile is cleared. This statement in Porras discloses clearing the entire short-term 
profile. In contrast, claims 2 and 38 recite removing a least recent record event from the 
statistical model. In addition, claim 2 further defines paten tably distinct claim 1, and claim 
38 further defines patentably distinct claim 37. Accordingly, claims 2 and 38 are also 
believed to be allowable over the cited references. 

Claim 13 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras in 
view of Sarkissian et al., U.S. Patent No. 6,771,646 ("Sarkissian") and Fishman. 

Independent claim 13 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes defining a statistical model for analyzing 
the stream of network usage data over the rolling time interval; defining the rolling time 
interval to include a plurality of the time intervals; receiving a record event from the stream 
of data for each update time interval; storing the record event for each update interval in a 
history cache; generating the statistical model over the rolling time interval using the 
statistical model and each record event stored in the history cache; and updating the statistical 
model using the statistical model in a most recent record event for a most recent update time 
interval, including updating only a portion of the statistical model associated with the most 
recent record event. 
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Sarkissian merely recites a cache structure for looking up one or more elements of an 
external memory. The cache structure is used for storing information associated with 
network packets. 

For the same reasons as discussed above with reference to claims 1, 37, and 45, 
Porras, Sarkissian, and Fishman, either alone, or in combination, fail to teach or suggest 
updating only a portion of the statistical model associated with the most recent record 
event. The Examiner appears to have failed to address the limitation storing the record 
event for each update interval in a history cache. 

In view of the above, Porras, Sarkissian, and Fishman, either alone, or in combination, 
fail to teach or suggest the invention of independent claim 13. Accordingly, withdrawal of 
the rejection of claim 13 under 35 U.S.C. § 103(a) is respectfully requested. 

Claim 23 is rejected under 35 U.S.C. §103(a) as being unpatentable over Porras in 
view of Sarkissian and further in view of Kawasaki, U.S. Patent No. 6,539,375 ("Kawasaki") 
and Fishman. 

Independent claim 23 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes updating only a portion of the statistical 
model associated with the most recent record event for a most recent update time interval. 

Kawasaki discloses a method and system for generating and using a computer user's 
personal interest profile. 

For the same reasons as discussed above with reference to claims 1, 37, and 45, 
Porras, Sarkissian, Kawasaki, and Fishman, either alone, or in combination, fail to teach or 
suggest updating only a portion of the statistical model associated with the most recent 
record event for a most recent update time interval. 

In addition, there is no teaching or suggestion to combine the method of generating 
and using a computer user's personal interest profile of Kawasaki with the network 
surveillance system of Porras, the cache system of Sarkissian, and the method of building 
predictive models based on transactional data of Fishman. 

In view of the above, Porras, Sarkissian, Kawasaki, and Fishman, either alone, or in 
combination, fail to teach or suggest the invention of independent claim 23. Accordingly, 
withdrawal of the rejection of claim 23 under 35 U.S.C. § 103(a) is respectfully requested. 
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Claims 29-36 are rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras 
in view of Sarkissian, Fishman, Costa, U.S. Patent No. 6,138,121 ("Costa"), and Aboulnaga, 
U.S. Patent No. 6,460,045 ("Aboulnaga"). 

Independent claim 29 recites a method for analyzing a stream of network usage data 
over a rolling time interval. The method includes defining a statistical model for analyzing 
the stream of network usage data over the rolling time interval, the statistical model including 
a histogram having a first axis illustrating total usage defined by a number of bins, each bin 
having a usage variable range, and a second axis defined by a frequency corresponding to a 
number of users having a total usage within the usage variable range of each bin; defining the 
rolling time interval to include a plurality of update time intervals; receiving a record event 
set from the stream of network data for each update time interval; storing the record event set 
for each update interval in a history cache; generating the statistical model over the rolling 
time interval using each record event stored in the history cache including generating an 
aggregation table; and updating the statistical model using a most recent record event for a 
most recent update time interval including updating only a portion of the aggregation table 
associated with the most recent update time interval. 

Costa merely discloses the use of an aggregation table in tracking network status 

events. 

Aboulnaga discloses building histograms by using feedback information about the 
execution of query workload rather than by examining the data to help reduce the cost of 
building and maintaining histograms. 

Porras, Sarkissian, Fishman, Costa, and Aboulnaga, either alone, or in combination, 
fail to teach or suggest defining a statistical model for analyzing the stream of network 
usage data over the rolling time interval, the statistical model including a histogram 
having a first axis illustrating total usage defined by a number of bins, each bin having a 
usage variable range, and a second axis defined by a frequency corresponding to a 
number of users having a total usage within the usage variable range of each bin. 
Further, none of the cited references, either alone or in combination, teach or suggest 
generating the statistical model over the rolling time interval using each record event 
stored in the history cache including generating an aggregation table; and updating the 
statistical model using a most recent record event for a most recent update time interval 
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including updating only a portion of the aggregation table associated with the most 
recent update time interval. 

In addition, there is no teaching or suggestion to combine the network management 
event storage system of Costa with the self-tuning histograms of Aboulnaga, the network 
surveillance system of Porras, the cache system of Sarkissian, and the method of building 
predictive models based on transactional data of Fishman. One skilled in the art could not 
combine theses references and arrive at the invention of claim 29. 

In view of the above, independent claim 29 is not taught or suggested by the cited 
references. Therefore, withdrawal of the rejection of claim 29 under 35 U.S.C. §103(a) is 
respectfully requested. 

Dependent claims 30-36 further define patentably distinct claim 29. Accordingly, 
dependent claims 30-36 are also believed to be allowable over the cited references. 

Further, Porras, Sarkissian, Fishman, Costa, and Aboulnaga, either alone, or in 
combination, fail to teach or suggest updating the statistical model further includes 
removing a least recent record event set associated with a least recent update time 
interval from the statistical model (claim 30), defining the statistical model to include an 
aggregation of each record event stored in the history cache (claim 31), wherein the 
history cache is an array of memory segments, wherein the number of memory 
segments is equal to the number of update time intervals in the rolling time interval 
(claim 32), storing each record event in a memory segment in the history cache (claim 
33), defining an index array associated including a set of contiguous index segments 
wherein each index segment including a pointer to the memory segment storing in the 
history cache storing the next consecutive record event (claim 34), defining a first 
pointer to the index segment associated with the memory segment storing the least 
recent record event (claim 35), and generating the histogram statistical model from the 
aggregation table; and updating only a portion of the histogram statistical model 
associated with the most recent record event set (claim 36). 

Claims 3 and 39 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Porras as applied to claims above, and further in view of Steinbiss et al., U.S. Patent No. 
6,823,307 ("Steinbiss"). 
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The Examiner admits Porras and Fishman fail to disclose storing the set of records in 
a history cache and wherein if the history cache is full updating the statistical model includes 
removing a least recent record event from the statistical model. The Examiner submits these 
limitations are taught by Steinbiss (Office Action, page 16). 

Steinbiss also fails to teach or suggest further comprising the steps of storing the 
set of record events in a history cache, and wherein if the history cache is full, updating 
the statistical model includes removing a least recent record event from the statistical 
model (claim 3) and defining a least recent record event; and wherein the data analysis 
system server removes the least recent record event from the statistical model (Claim 
39). 

Steinbiss discloses a language model based on a speech recognition history. A small 
vocabulary pattern recognition system is used for recognizing a sequence of words, such as a 
sequence of digits or a sequence of commands. (See Abstract). Steinbiss does not update the 
statistical model. Steinbiss merely discloses a first in-first out cache for a speech recognizer. 
(Col. 5, line 61 - col. 6, line 7). 

In addition, Steinbiss is not analogous art. A speech recognition system is not 
analogous to a network data usage analysis system. One skilled in the art would not look to a 
vocabulary pattern recognition system when designing a network data usage analysis system. 
In addition, there is no teaching or suggestion to combine the network surveillance system of 
Porras, the method of building predictive models based on transactional data of Fishman, and 
the vocabulary pattern recognition system of Steinbiss to arrive at the invention of claims 3 
and 39. Further, claim 3 further defines patentably distinct claim 1, and claim 39 further 
defines patentably distinct claim 37. Accordingly, dependent claims 3 and 39 are also 
believed to be allowable over the cited references. 

Claims 4 and 40 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Porras, Fishman, and Steinbiss as applied to claims above, and further in view of Sarkissian. 

Claim 4 further defines patentably distinct claim 1, and dependent claim 40 further 
defines patentably distinct claim 37. Accordingly, dependent claims 4 and 40 are also 
believed to be allowable over the cited references. 
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Claims 5, 6, 8-10, 12, and 41-43 are rejected under 35 U.S.C. §103(a) as being 
unpatentable over Porras, Fishman, Steinbiss, and Sarkissian as applied to claims above, and 
further in view of Costa. 

Dependent claims 5, 6, 8-10, and 12 further define patentably distinct claim 1. 
Dependent claims 41-43 further define patentably distinct claim 37. Accordingly, dependent 
claims 5, 6, 8-10, 12, and 41-43 are also believed to be allowable over the cited references. 

Claims 7, 11, and 14-22 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Porras, Fishman, Steinbiss, Sarkissian, and Costa as applied to claims above, and further 
in view of Aboulnaga. 

Dependent claims 7 and 1 1 further define patentably distinct claim 1. Dependent 
claims 14-22 further define patentably distinct claim 13. Accordingly, dependent claims 7, 
11, and 14-22 are also believed to be allowable over the cited references. 

Claims 8-10, 43, and 44 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Porras, Steinbiss, Sarkissian, and Costa as applied to claims above, and further in view 
of Fishman. 

Dependent claims 8-10 further define patentably distinct claim 1. Dependent claims 
43 and 44 further define patentably distinct claim 37. Accordingly, dependent claims 8-10, 
43, and 44 are also believed to be allowable over the cited references. 

Claim 24 is rejected under 35 U.S.C. §103(a) as being unpatentable over Porras, 
Sarkissian, Kawasaki, and Fishman as applied to the claims above, and further in view of 
Steinbiss. 

Dependent claim 24 further defines patentably distinct claim 23. Accordingly, 
dependent claim 24 is also believed to be allowable over the cited references. 

Further, for the reasons previously described with reference to claims 2, 3, 38, and 39 
Porras, Sarkissian, Kawasaki, Fishman, and Steinbiss, either alone, or in combination, fail to 
teach or suggest wherein if the history cache is full, updating the statistical model further 
includes removing a least recent record event set associated with the least recent update 
time interval from the statistical model. 

Claims 25 and 26 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Porras, Sarkissian, Kawasaki, and Fishman as applied to claims above, and further in view of 
Costa. 



18 



Amendment and Response under 37 C.F.R. 1.116 

Applicant: N, Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 31, 2001 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS 

Dependent claims 25 and 26 further define patentably distinct claim 23. Accordingly, 
dependent claims 25 and 26 are also believed to be allowable over the cited references. 

Claims 27 and 28 are rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Porras, Sarkissian, Kawasaki, Fishman, and Costa as applied to claims above, and further in 
view of Aboulnaga. 

Dependent claims 27 and 28 further define patentably distinct claim 23. Accordingly, 
dependent claims 27 and 28 are also believed to be allowable over the cited references. 

Claim 36 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Porras, 
Sarkissian, Fishman, and Costa as applied to claims above, and further in view of Aboulnaga. 

Claim 36 further defines patentably distinct claim 29. Accordingly, dependent claim 
36 is also believed to be allowable over the cited references. 

For the same reasons as discussed above with reference to the above claims, 
independent claim 46 is not taught or suggested by Porras, Fishman, Steinbiss, Sarkissian, 
Costa, and Aboulnaga, either alone, or in combination. Withdrawal of the rejection of claim 
46 under 35 U.S.C. § 103(a) is respectfully requested. 

Dependent claim 47 further defines patentably distinct claim 46. Accordingly, 
dependent claim 47 is also believed to be allowable over the cited references. 



19 



Amendment and Response under 37 C.F.R. 1.116 

Applicant: N. Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 31,2001 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS 

CONCLUSION 

In view of the above, Applicant respectfully submits that pending claims 1-47 are in 
form for allowance and are not taught or suggested by the cited references. Therefore, 
reconsideration and withdrawal of the rejections and allowance of claims 1-47 is respectfully 
requested. 

The Examiner is invited to contact the Applicant's representative at the below-listed 
telephone numbers to facilitate prosecution of this application. 

Any inquiry regarding this Amendment and Response should be directed to either 
William J. Streeter at Telephone No. (970) 898-3886, Facsimile No. (970) 898-7247 or 
Steven E. Dicke at Telephone No. (612) 573-2002, Facsimile No. (612) 573-2005. In 
addition, all correspondence should continue to be directed to the following address: 

Hewlett-Packard Company 

Intellectual Property Administration 
P.O. Box 272400 

Fort Collins, Colorado 80527-2400 

Respectfully submitted, 
N. Lee Rhodes, 
By his attorneys, 

DICKE, BILLIG & CZAJA, PLLC 
Fifth Street Towers, Suite 2250 
100 South Fifth Street 
Minneapolis, MN 55402 
Telephone: (612) 573-2002 
Facsimile: (612) 573-2005 
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